certmate-cli 0.1.5__tar.gz → 0.1.6__tar.gz

{certmate_cli-0.1.5 → certmate_cli-0.1.6}/.gitignore

@@ -119,3 +119,5 @@ UI_REDESIGN_PLAN.md
 # Local nginx reverse-proxy config: copy nginx.conf.example to nginx.conf and
 # fill in your domain. The copy is yours; the example is tracked (#576).
 nginx.conf
+tls-erros.md
+.mypy_cache/

{certmate_cli-0.1.5 → certmate_cli-0.1.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: certmate-cli
-Version: 0.1.5
+Version: 0.1.6
 Summary: CertMate command-line interface — the SSL certificate lifecycle from your terminal
 Project-URL: Homepage, https://github.com/fabriziosalmi/certmate
 Project-URL: Source, https://github.com/fabriziosalmi/certmate/tree/main/clients/certmate-cli
@@ -23,7 +23,7 @@ Classifier: Topic :: Security
 Classifier: Topic :: System :: Systems Administration
 Classifier: Topic :: Utilities
 Requires-Python: >=3.9
-Requires-Dist: certmate-sdk>=0.1.5
+Requires-Dist: certmate-sdk>=0.1.6
 Requires-Dist: rich>=13
 Requires-Dist: typer>=0.9
 Description-Content-Type: text/markdown
@@ -34,7 +34,7 @@ The [CertMate](https://github.com/fabriziosalmi/certmate) SSL certificate
 lifecycle from your terminal — built on `certmate-sdk`.
 
 ```bash
-pip install certmate-cli
+pip install certmate-cli     # or, on macOS/Linux: brew install fabriziosalmi/certmate/certmate-cli
 export CERTMATE_URL=http://localhost:8000
 export CERTMATE_TOKEN=...
 
@@ -43,9 +43,16 @@ certmate cert ls
 certmate cert info app.example.com
 certmate cert renew app.example.com --force
 certmate cert create app.example.com --dns cloudflare --dry-run
+certmate cert create app.example.com --name internal.example.com --dns cloudflare
 certmate audit verify
 ```
 
+`--name` names a second certificate for a domain apart from it: the certificate
+is issued for `app.example.com`, and every later command takes
+`internal.example.com`. The server must be on API contract 2.61 or later; an
+older one would ignore the name, so the CLI asks first and refuses, and
+`--dry-run` says whether the server takes it.
+
 ## Pulling certificates onto a host
 
 `cert download` fetches one file at a time, so a target server can pull

{certmate_cli-0.1.5 → certmate_cli-0.1.6}/README.md

@@ -4,7 +4,7 @@ The [CertMate](https://github.com/fabriziosalmi/certmate) SSL certificate
 lifecycle from your terminal — built on `certmate-sdk`.
 
 ```bash
-pip install certmate-cli
+pip install certmate-cli     # or, on macOS/Linux: brew install fabriziosalmi/certmate/certmate-cli
 export CERTMATE_URL=http://localhost:8000
 export CERTMATE_TOKEN=...
 
@@ -13,9 +13,16 @@ certmate cert ls
 certmate cert info app.example.com
 certmate cert renew app.example.com --force
 certmate cert create app.example.com --dns cloudflare --dry-run
+certmate cert create app.example.com --name internal.example.com --dns cloudflare
 certmate audit verify
 ```
 
+`--name` names a second certificate for a domain apart from it: the certificate
+is issued for `app.example.com`, and every later command takes
+`internal.example.com`. The server must be on API contract 2.61 or later; an
+older one would ignore the name, so the CLI asks first and refuses, and
+`--dry-run` says whether the server takes it.
+
 ## Pulling certificates onto a host
 
 `cert download` fetches one file at a time, so a target server can pull

{certmate_cli-0.1.5 → certmate_cli-0.1.6}/certmate_cli/__init__.py

@@ -1,2 +1,2 @@
 """certmate-cli — the CertMate SSL lifecycle from your terminal (built on certmate-sdk)."""
-__version__ = "0.1.5"
+__version__ = "0.1.6"

{certmate_cli-0.1.5 → certmate_cli-0.1.6}/certmate_cli/main.py

@@ -21,7 +21,7 @@ import typer
 from rich.console import Console
 from rich.table import Table
 
-from certmate import Client, CertMateError, Job
+from certmate import CertMateError, Client, Job, UnsupportedByServer
 
 app = typer.Typer(no_args_is_help=True, add_completion=False,
                   help="CertMate — the SSL certificate lifecycle from your terminal.")
@@ -207,6 +207,10 @@ def cert_info(ctx: typer.Context, domain: str):
     """Show a certificate's details."""
     c = _run(lambda: _client(ctx).get_certificate(domain))
     out.print(f"[bold]{c.domain}[/]")
+    if c.host and c.host != c.domain:
+        # Where it is served, when that is not its name: an IP certificate's
+        # address, or the host a certificate named apart from it is for.
+        out.print(f"  host:        {c.host}")
     if c.has_expired() is True:
         remaining = "[red]expired[/]"
     elif c.days_until_expiry is None:
@@ -233,6 +237,12 @@ def cert_create(
     dns: Optional[str] = typer.Option(None, "--dns", help="DNS provider (e.g. cloudflare)."),
     ca: Optional[str] = typer.Option(None, "--ca", help="CA provider (e.g. letsencrypt)."),
     san: Optional[str] = typer.Option(None, "--san", help="Comma-separated SAN domains."),
+    # A str with an empty default, not Optional: typer reads the annotation at
+    # runtime, and `str | None` is not one on Python 3.9.
+    name: str = typer.Option(
+        "", "--name",
+        help="Name the certificate apart from its domain, for a second certificate for it "
+             "(server API contract 2.61 or later)."),
     wait: bool = typer.Option(True, "--wait/--no-wait", help="Wait for issuance to finish."),
     dry_run: bool = typer.Option(False, "--dry-run",
                                  help="Validate inputs and preflight the DNS provider WITHOUT issuing."),
@@ -242,6 +252,8 @@ def cert_create(
     # bogus "" SAN entry — mirrors cert_reissue.
     sans: List[str] = [s.strip() for s in san.split(",") if s.strip()] if san else []
     client = _client(ctx)
+    # What it is issued as: the domain, and the name it is given apart from it.
+    issued_as = f"{domain} as {name}" if name else domain
 
     if dry_run:
         problems = []
@@ -250,6 +262,16 @@ def cert_create(
         for s in sans:
             if not _DOMAIN_RE.match(s):
                 problems.append(f"SAN {s!r} does not look valid")
+        if name:
+            # The server's rule (#1149): the shape of a DNS name, never a wildcard.
+            if not _DOMAIN_RE.match(name) or name.startswith("*."):
+                problems.append(f"name {name!r} is not a DNS name")
+            try:
+                client.require_contract("2.61", "name")
+            except UnsupportedByServer as e:
+                problems.append(str(e))
+            except CertMateError as e:
+                _die(str(e))
         if dns:
             res = _run(lambda: client.test_dns_provider(dns))
             ok = bool(res.get("success", res.get("ok", True)))
@@ -261,23 +283,23 @@ def cert_create(
             out.print("[dim]No --dns given; skipping provider preflight.[/]")
         if problems:
             _die("dry-run found issues:\n  - " + "\n  - ".join(problems))
-        out.print(f"[green]dry-run OK[/] — would issue [bold]{domain}[/]"
+        out.print(f"[green]dry-run OK[/] — would issue [bold]{issued_as}[/]"
                   f"{(' (+' + str(len(sans)) + ' SAN)') if sans else ''}"
                   f"{(' via ' + dns) if dns else ''}{(' on ' + ca) if ca else ''}. Nothing issued.")
         return
 
     def _issue():
-        with out.status(f"Issuing [bold]{domain}[/] …") as status:
+        with out.status(f"Issuing [bold]{issued_as}[/] …") as status:
             def _progress(j: Job):
                 if j.status:
-                    status.update(f"Issuing [bold]{domain}[/] … [{j.status}]")
+                    status.update(f"Issuing [bold]{issued_as}[/] … [{j.status}]")
             return client.create_certificate(
                 domain, dns_provider=dns, ca_provider=ca, san_domains=sans or None,
-                wait=wait, on_progress=_progress)
+                name=name or None, wait=wait, on_progress=_progress)
 
     job = _run(_issue)
     if wait:
-        out.print(f"[green]issued[/] [bold]{domain}[/]"
+        out.print(f"[green]issued[/] [bold]{issued_as}[/]"
                   f"{(' (' + job.status + ')') if job.status else ''}.")
     else:
         out.print(f"[yellow]accepted[/] — job [bold]{job.job_id}[/] "

{certmate_cli-0.1.5 → certmate_cli-0.1.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "certmate-cli"
-version = "0.1.5"
+version = "0.1.6"
 description = "CertMate command-line interface — the SSL certificate lifecycle from your terminal"
 readme = "README.md"
 requires-python = ">=3.9"
@@ -33,10 +33,10 @@ classifiers = [
 # The SDK floor tracks the CLI release, and now something enforces that:
 # tests/test_version_consistency.py fails if this floor falls behind the SDK
 # in the tree. It had already drifted once, sitting at 0.1.3 while both
-# packages were 0.1.4. 0.1.5 is needed for Certificate.has_expired(), which
-# `cert ls` and `cert info` call on every row.
+# packages were 0.1.4. 0.1.6 is needed for Client.require_contract(), which
+# `cert create --name --dry-run` calls, and create_certificate(name=...).
 dependencies = [
-    "certmate-sdk>=0.1.5",
+    "certmate-sdk>=0.1.6",
     "typer>=0.9",
     "rich>=13",
 ]